Everything the server knows
Not a redacted view — this is the whole database. Imagine it leaked tomorrow and ask yourself what an attacker could do with it.
2
accounts
2
public keys stored
0
passwords stored
0
password hashes stored
Raw records
Refreshes every few seconds, so you can leave this open while you register in another window.
{
"users": [
{
"id": "KbjXHM8nyeiUsseCfgeqs9h7mUFySOG7ViyC31BthI4",
"username": "passkeydemo",
"displayName": "passkeydemo",
"createdAt": "2026-08-29T02:17:50.561Z",
"credentials": [
{
"id": "5XqbxTWfYkB-yw-_hwaDRHdu63TmreGcBjqmYtlJvnw",
"publicKey": "pQECAyYgASFYIESmF8v8iJVFiXIVRdeCFBV8NqeY-VcRBG1yB36BJRx0IlggYhWmUj6ApHf045hIMa2CroLu5z0t_rcyGi0vScTiagU",
"counter": 4,
"transports": [
"internal"
],
"deviceType": "singleDevice",
"backedUp": false,
"aaguid": "08987058-cadc-4b81-b6e1-30de50dcbe96",
"nickname": "This device (built-in)",
"createdAt": "2026-08-29T02:17:50.561Z",
"lastUsedAt": "2026-09-04T18:16:42.598Z"
}
]
},
{
"id": "_3NYiQtsx02JtfDFOlKPHfx2f7owjFO93FZwuy82GHc",
"username": "iphonepasskey",
"displayName": "iphonepasskey",
"createdAt": "2026-09-04T16:22:55.000Z",
"credentials": [
{
"id": "MUdi-5drlEY8VU_hOpjd_rAHKu0",
"publicKey": "pQECAyYgASFYIAyr1S6qIPAGWLmW1kHQjyMmfOGH2wVTiDqgCzl6nj4ZIlggatBd1vCPCkZLAQ7WvXrKARzCvePCLirIifKXApzlXNU",
"counter": 0,
"transports": [
"internal",
"hybrid"
],
"deviceType": "multiDevice",
"backedUp": true,
"aaguid": "fbfc3007-154e-4ecc-8c0b-6e020557d7bd",
"nickname": "Phone or tablet (cross-device)",
"createdAt": "2026-09-04T16:22:55.000Z",
"lastUsedAt": "2026-09-04T17:42:40.246Z"
}
]
}
]
}Relying Party configuration
{
"rpName": "Passkey Demo",
"rpId": "passkey.karanpatel.ca",
"origins": [
"https://passkey.karanpatel.ca"
],
"storeDriver": "redis"
}rpId is the domain every passkey above is bound to. Change it and every existing passkey stops working — which is the same reason a look-alike domain can't use them.